A Policy-aware Switching Layer for Data Centers

Transcription

1 A Policy-aware Switching Layer for Data Centers Dilip Joseph Arsalan Tavakoli Ion Stoica University of California at Berkeley 1 Problem: Middleboxes are hard to deploy Place on network path Overload path selection mechanisms pkt Load Balancer On path placement fails to achieve network path Flexibility Efficiency Correctness (Re)configurable network topology No middlebox resource wastage Guaranteed middlebox traversal 1

2 Preview Problem Middleboxes are hard to deploy Solution Overview Challenges Limitations Implementation & evaluation Related work Common data center topology Core Internet Layer-3 router Data Center Aggregation Load Balancer Layer-2/3 switch Access Layer-2 switch Servers 2

3 Inflexible topology Internet Intrusion Prevention Box Load Balancer Inefficient - middlebox resource wastage Internet Process unnecessary traffic Backup path Unutilized 3

4 Correctness is hard Internet Protect S1 S2 traffic Option 1 Existing firewalls Newly blocked link S1 S2 Correctness is hard Internet Protect S1 S2 traffic Option 1 Existing firewalls Option 2 New firewall S1 S2 4

5 Correctness is hard Internet Protect S1 S2 traffic Option 1 Existing firewalls Option 2 New firewall Option 3 Separate VLANs S1 S2 Outline Problem Middleboxes are hard to deploy Solution Overview Challenges Limitations Implementation & evaluation Related work 5

6 Policy-aware Switching Layer 1 Take middleboxes off-path 2 Separate policy from reachability HTTP Load balancer TCP port = 80 firewall load balancer PSwitch P P P P P P P P P P P P PP P Existing mechanisms firewall load balancer Policy-aware switching layer PSwitch explicitly forwards packets to middleboxes (F) Load Balancer (L) Data center Header Body Src:L Centralized Policy Controller Src:R Core Router R P P P P P PSwitch Match 3 Next Hop Web Server MAC R,port 80 F Interface 1, port 80 L MAC L,port 80 FinalDest HTTP Rule table Load balancer 6

7 Distributed forwarding Loadbalancing middleboxes Different policies for different traffic Data center Load Balancer Custom Intrusion Prevention Box PSwitch A PSwitch B HTTP Load balancer ERP Custom IPS Web Server ERP Server Challenges 1. Minimizing infrastructure changes 2. Non-transparent middleboxes 3. Guaranteeing correctness under churn 7

8 Guarantees under Churn Network Middlebox Policy Packets never bypass middleboxes Some packets may be dropped Limitations Indirect paths Policy specification complexity 8

9 Outline Problem Middleboxes are hard to deploy Solution Overview Challenges Limitations Implementation & evaluation Related work Implementation PSwitches prototyped in Compared to software Ethernet switch 82% TCP throughput 16% latency increase 750 Mbps P P P P P PSwitch 0.3 milliseconds 25 policies Exploring hardware options 9

10 Validation of functionality 10 PCs with 4 network interfaces each iptables firewalls BalanceNG Load balancer webservers client P P P P P P P PP P P P PP P P P PP P Physical topology Logical topologies on same physical topology X 10

11 Related Work Indirection Separation of policy and reachability High-end switches SIGCOMM 2008 Internet Indirection Infrastructure Delegation Oriented Architecture 4D Routing Control Platform Ethane Cisco Catalyst 6500 SEATTLE DCell Commodity DC Network Architecture Conclusion Deploying middleboxes is hard A new layer-2 with explicit middlebox support Middleboxes taken off network path Policy separated from reachability 11

12 Questions? Backup Slides 12

13 Policy churn Conflicting policy updates Version 1 Version 2 HTTP HTTP Load balancer Load balancer Load Balancer P P P P P 3 Version 1 Version 2 Match Next Hop Match Interface 0, port 80 L Interface 0, port 80 Interface 2, port 80 F Interface 2, port 80 Interface 1, port 80 FinalDest Interface 1, port 80 Next Hop F FinalDest L Intermediate middlebox types Guarantees traversal Version 1 Version 2 HTTP HTTP Load balancer Load balancer Load Balancer Load Balancer P P P P P 13